Device fingerprinting replaces third-party cookies as primary web tracking method
As browser restrictions tighten on cookies, advertisers are adopting fingerprinting—extracting unique device identifiers from browser data—to track users across the web.
What to know
- Device fingerprinting has emerged as the primary tracking method replacing third-party cookies, extracting unique browser identifiers from OS, user agent, hardware, and IP data.
- Google promised to eliminate third-party cookies in 2020 but instead maintained tracking via alternative methods, including fingerprinting in its ad products.
- Technical defenses exist (Tor Browser, privacy-first configs) but are not widely accessible; mainstream browsers like Chrome and Safari do not fully protect users from fingerprinting.
- The fingerprinting technique's persistence—whether it remains stable enough for consistent tracking across sessions—is contested among developers; practical commercial viability differs from theoretical demonstration.
The dispute Whether device fingerprinting is practically effective for commercial tracking at scale or remains mostly theoretical; commenters dispute the reliability and persistence of fingerprints across sessions. · positions read across 81 posts and comments
Fingerprinting is theoretically possible but impractical at commercial scale due to lack of stability across sessions.
-
“Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking…”
legitster · Hacker News ↗
Fingerprinting is a serious privacy threat that current browser protections do not adequately defend against.
-
“Fingerprinting is really bad for privacy and the defenses against it are not there.”
Cider9986 · Hacker News ↗
The root problem is JavaScript's excessive power; stricter browser permission controls are needed to limit fingerprinting vectors.
-
“The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the…”
drnick1 · Hacker News ↗
Only a comprehensive ban on third-party advertising can solve the tracking problem; technical mitigations are insufficient.
-
“Theres only one solution, ban third party advertising. Everything else is a compromise that doesnt work anyway.”
MiroslavPokorny · Hacker News ↗
Royfish Developer and analystGoogle Browser vendor and ad platform operator
How it unfolded 1 development · click the chart to see its coverage articlespostscomments
-
1
Developer publishes analysis of fingerprinting as successor to cookies
Royfish publishes a detailed technical essay demonstrating how device fingerprinting works and arguing it has become the de facto replacement for third-party cookies in web tracking. The piece traces the regulatory and industry path from cookies to fingerprinting, showing how companies have sidestepped privacy protections.
“I look at all this data and I don't see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche.”
— Royfish -
2 outlets Fingerprints are the new cookies
first by HN Best, 3d ago · also HN Frontpage
-
> The law could be very simple A classic of the "why don't we just?" genre. The law is complicated for a reason (I say as someone who worked on privacy matters as a lawyer). So let's talk about your proposed law #1. I run ZomboCom LLC, and I have some users who've given me money in exchange for being part of the ZomboCommmunity. It's coming to the…
2 more of the top 3 · 81 posts in this stretch
-
> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things…
-
Wishful thinking, but I wonder how the internet would be different if we just made it illegal to sell information about people.
-
-
background
Google enables device fingerprinting in ad products — Google moves to permit device fingerprinting as an official tracking method within its ad products, extracting unique identifiers from browser configurations, user agents, OS data, IP addresses, and other metadata.
-
background
Google abandons cookie deprecation; maintains tracking via IP masking and Privacy Sandbox — Five years after the pledge, Google maintains third-party cookies while proposing alternative tracking methods like IP masking (with limited scope) and Privacy Sandbox solutions. The Privacy Sandbox raises antitrust concerns and sees low adoption.
-
background
Google pledges to destroy third-party cookies and establish privacy-first browsing — Google announces it will deprecate third-party cookies and establish what it calls a 'privacy-first reign' in ad technology.
-
background
Third-party cookies become privacy liability; browsers begin blocking them — Amid growing privacy concerns, Safari and Firefox begin blocking third-party cookies. The EU introduces consent banners. Third-party cookie tracking becomes recognized as bad PR.
What people are saying 21 voices from 2 sites · best of 81 · verbatim
- Oct 13
-
The GDPR is already fairly simple: data sharing requires *informed* consent. The person whose data are being shared needs to understand the thing that they are consenting to. If they do not, then you do not have consent. The problem is not the law, it's the enforcement. Note that the GDPR says very little specifically about cookies…
- Oct 12
-
> Edit: I'm Cheeky Raven in both normal and incognito. Does that mean my normal session is also fully anonymized ? Err... I think that would mean that there's no benefit to using the incognito window? If you have the same identifier across both then your private window isn't helping much and sites can track you as the same person across both... I…
-
Thank you for the lovely examples! I did fairly deliberately say "sell" not "share" with my original statement, for *some* of these reasons, though it's a much weaker statement. I think it'd be a lot easier to mop up the ecosystem of the more abusive bottom-feeders a bit than solve the problem in one fell swoop, though I can already think of ways…
-
Well, what niche market would browse https://coveryourtracks.eff.org/ ?
-
Thanks for replying with your expertise. Very useful! > It's coming to the end of the year and my accounts are a mess, so I engage a bookkeeper to work through my paperwork. I give them access to my Stripe account so they can reconcile incomings. Have I breached the law? Do I need to ask all my customers first, and do I need to disclose the…
-
Doing this on GrapheneOS's built in Vanadium browser, I am concerned to see that the ID remains the same if I move to incognito tabs, or even a private space. Or perhaps Vanadium is doing such a magnificent job of reporting generic info that this ID would be the same for anyone using Vanadium on my model of Pixel, but I don't think so, since the…
-
>Test your browser:>coveryourtracks.eff.org shows you how unique your fingerprint is, with entropy for each measured data point.Something to note - if a fingerprint is generic enough, that might be a _good_ thing!Having worked with fingerprinting, anti-fingerprint browsers are very hard to properly identify. The ways to get around it are things…
-
The law could be very simple : 1. Any data collected by a private entity A about an individual X cannot be shared to another entity B without the explicit agreement of X at the moment of the share. Agreement should be given for each transaction. The way it is shared doesn’t matter. If A is bought by entity B, X should consent to its data being…
-
These are all a joke anywayIf you've ever worked at a startup, you're probably familiar with the fact that no one gives a crap about this type of stuff early onThe hell with pretty much anything, the only thing that matters is revenuePeople only start to care about this after the fact if you've grown to large enough sizeIf you think stuff like…
-
The EU/banner situation keeps confusing people because there are two different laws in play:1) ePrivacy. the OG banner law. requires you to inform the user (but not consent, as I understand it) if you store data on a user's device. includes cookies, localStorage, indexedDB, etc. does not affect fingerprinting 2) gdpr. requires you to ask consent…
-
How could this information be surfaced in a reasonable way in administration software?Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new…
-
Unfortunately, fingerprinting scripts are quite often first-party. Moreover, popular CDNs offer the service of embedding these type of scripts directly into the served HTML :/
-
> Is it different in incognito? Good. But it’s always the same? Bad news. If I visit the webpage in private browsing mode with Firefox (153.0.1) I get a different fingerprint as in non-private browsing mode. But the fingerprint on private browsing mode does not change if I refresh page, restart Firefox and re-open the page or even if I use the…
-
Opening in private browsing gives me a different fingerprint, which does not really make this a convincing argument. I also asked a couple of colleagues with the same Macbook Pro. Some of them actually get the same fingerprint as I do.
-
I feel it's worth distinguishing between the Hacker News Audience that is highly tech-educated and security-conscious and the general public that just wants to use the web and seems more than happy to give all their data to Meta, Google & Co.If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If…
-
The solution has to come from law. I propose we handle privacy invasion the same as rape. Body and mind aren't up for grabs. That the average internet user is unconscious isn't a valid excuse.It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such…
-
> the consenst banner is required either way.Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.The banner is an artefact of the hostile way most sites choose to try and…
-
The only way to win is to not allow connections to third parties.
-
I still don't understand why the highest entropy APIs aren't gated behind browser consent.A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should…
-
Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching…
- Oct 11
-
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of…